A 26-year-old Canadian man pleaded guilty this week to charges tied to one of the largest data theft campaigns in recent memory, a scheme that started with something surprisingly ordinary: accounts that simply didn’t have multi-factor authentication turned on.
Authorities arrested Connor Riley Moucka, who also went by Alexander Moucka and the online handle Waifu, back in October 2024. Prosecutors say that between February and October of that year, Moucka and co-defendant John Erin Binns broke into customer accounts on Snowflake, the cloud storage provider, using login credentials they stole through infostealer malware. Because those particular accounts had no MFA protection, a correct username and password was all it took to get in.
From there, the pair reportedly used custom software to sift through massive amounts of stored data, picking out whatever looked valuable: banking details, payroll records, Social Security numbers, driver’s license and passport numbers, DEA registration numbers, and call and text history. After pulling terabytes of data out of victims’ Snowflake environments, they tried extorting companies directly and collected at least $2.5 million in bitcoin from three victims. They also sold stolen data on hacker forums, pulling in another $495,000 or so through those sales.
One detail stands out even among the rest of the case. According to the Department of Justice, Moucka extorted one victim a second time, using stolen personal data belonging to a government officer’s family members as leverage.
The scale here is hard to overstate. The DOJ says the breaches affected more than 100 million people, and victim companies collectively lost over $9.5 million. The list of impacted organizations reads like a roundup of household names: AT&T, Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard, and Neiman Marcus, among others.
Moucka pleaded guilty to four counts, including computer fraud and aggravated identity theft, and faces up to 32 years in prison when he’s sentenced on October 27. Authorities arrested Binns in Turkey, where an extradition request from U.S. prosecutors is still working its way through the courts.
In response to the breaches, Snowflake has since started enforcing MFA and requiring longer, 14-character minimum passwords.
